{"record":{"id":"ae6fd930c80b1178","repo":"ory/kratos","slug":"api-key-auth-strategy-requires-a-string-value","errorCode":null,"errorMessage":"api_key auth strategy requires a string value","messagePattern":"api_key auth strategy requires a string value","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"request/auth.go","lineNumber":40,"sourceCode":"\t\tin    string\n\t}\n\tAuthStrategy interface {\n\t\tapply(req *retryablehttp.Request)\n\t}\n)\n\nfunc authStrategy(typ string, config map[string]any) (AuthStrategy, error) {\n\tswitch typ {\n\tcase \"\":\n\t\treturn NewNoopAuthStrategy(), nil\n\tcase \"api_key\":\n\t\tname, ok := config[\"name\"].(string)\n\t\tif !ok {\n\t\t\treturn nil, fmt.Errorf(\"api_key auth strategy requires a string name\")\n\t\t}\n\t\tvalue, ok := config[\"value\"].(string)\n\t\tif !ok {\n\t\t\treturn nil, fmt.Errorf(\"api_key auth strategy requires a string value\")\n\t\t}\n\t\tin, _ := config[\"in\"].(string) // in is optional\n\t\treturn NewAPIKeyStrategy(in, name, value), nil\n\tcase \"basic_auth\":\n\t\tuser, ok := config[\"user\"].(string)\n\t\tif !ok {\n\t\t\treturn nil, fmt.Errorf(\"basic_auth auth strategy requires a string user\")\n\t\t}\n\t\tpassword, ok := config[\"password\"].(string)\n\t\tif !ok {\n\t\t\treturn nil, fmt.Errorf(\"basic_auth auth strategy requires a string password\")\n\t\t}\n\t\treturn NewBasicAuthStrategy(user, password), nil\n\t}\n\n\treturn nil, fmt.Errorf(\"unsupported auth type: %s\", typ)\n}\n","sourceCodeStart":22,"sourceCodeEnd":58,"githubUrl":"https://github.com/ory/kratos/blob/b86338da04a040247a07f46100a86dcfb3875909/request/auth.go#L22-L58","documentation":"authStrategy requires the api_key strategy's \"value\" (the secret) to be a string. If config[\"value\"] is missing or of another JSON/YAML type, the builder returns this error and the webhook cannot be constructed.","triggerScenarios":"api_key auth config where \"value\" is absent, a number (value: 12345), a bool, or an object — e.g. secrets read from env templating that expanded to a numeric literal.","commonSituations":"API keys that are all digits parsed as YAML integers; forgetting to quote the secret in YAML; env var substitution returning empty (value: ) making it null.","solutions":["Quote the value so it parses as a string: value: \"12345\"","Ensure the env var referenced for the secret is set and non-empty","Add the missing value key to the api_key auth config","Confirm the strategy is api_key and not basic_auth (which uses user/password)"],"exampleFix":"// before\nauth:\n  type: api_key\n  name: X-Api-Key\n  value: 12345678\n// after\nauth:\n  type: api_key\n  name: X-Api-Key\n  value: \"12345678\"","handlingStrategy":"validation","validationCode":"// Go: check api_key secret before building\nfunc validateAPIKeyValue(cfg map[string]interface{}) error {\n\tv, ok := cfg[\"value\"].(string)\n\tif !ok || v == \"\" {\n\t\treturn errors.New(\"api_key auth requires a non-empty string value\")\n\t}\n\treturn nil\n}","typeGuard":"func hasAPIKeyValue(cfg map[string]interface{}) bool {\n\tv, ok := cfg[\"value\"].(string)\n\treturn ok && v != \"\"\n}","tryCatchPattern":"b, err := request.NewBuilder(cfg)\nif err != nil {\n\tif strings.Contains(err.Error(), \"requires a string value\") {\n\t\treturn fmt.Errorf(\"api_key auth 'value' must be a quoted string secret\")\n\t}\n\treturn err\n}","preventionTips":["Always quote secrets in YAML: value: \"12345\"","Ensure env vars backing secrets are set before the process starts","Fail fast in CI when secret interpolation yields empty values","Avoid all-digit unquoted keys — YAML will coerce them to integers"],"tags":["configuration","auth","type-mismatch","secrets"],"backgroundTag":"config-type-mismatch","analyzedSha":"b86338da04a040247a07f46100a86dcfb3875909","analyzedAt":"2026-09-07T15:58:15.934Z","contentChangedAt":"2026-09-07T15:58:15.934Z","schemaVersion":2},"datasetVersion":"2026-09-16T09:17:16.951Z"}